Professional Documents
Culture Documents
Intro
Most of enterprise today move to IPsec over GRE tunnel to save cost, but I'm not saying that
this technology already rule out MPLS, lease line, etc. It depend on that site, how critical it is,
how stable the internet connection is. Usually small office like sales that only have few
workers use this to connect to corporate LAN.
IPsec and GRE Tunnel is 2 different thing, we'll go with IPsec first, then brief about GRE
then I'll give you an example of IPsec over GRE tunnel
IPsec
The three main point of IPsec is
Authentication
Data Integrity
Confidentiality
Authentication
to make sure you communicating or talking to the right person
Data Integrity
to make sure what you sending is received at the destination with the same shape, mean no
modification happen along the way
confidentiality
to make sure what send not able to be seen by third party
Negotiation : IKE
Security : AH, ESP, ESP+AH
Encryption : DES. 3DES, AES
Authentication : MDS, SHA
2 Mode of communication
Transport Mode
This mode is used when data need to be secure within the LAN, maybe super important and
high confidentiality kind of data
from the picture above, the encryption/protection only apply to layer 4 and above, this is
because this packet only travel within the LAN, so there's no point to protect the ip packet.
Secure communication happen between two point, other party can't read the packet from
layer4 and above only, they still can read the IP layer.
Tunnel Mode
This mode is used when packet need to travel across a public network, where it's dangerous
to let other to see the private/internal IP information
In this mode, encryption is done starting from IP header(layer3) and above to protect the
internal IP information, new public IP header then will be added so this packet can be routed
in public network.
The two type of encryption keys
Symmetric : each use same key to encrypt and decrypt data (shared key)
Asymmetric : public key to encrypt, private key to decrypt
Data Integrity
Data integrity is to make sure data is-untouched along the way to the destination. To make
sure this, first data will be calculated using a formula to produce a value, then it'll be hashed
and send ed. When received in the other site, it'll be re-calculated again, if the value is same
as value that produced before, it's mean that the data is clean from any modification.
IKE phase 1
From example above, R1 want to initiate a connection, so R1 gonna with sending message 1
Message 1 : negotiate a matching IKE SA policy between peer to protect IKE exchange
Message 2 : exchange DH key
Mesagge 3 : Make sure they are who they are (authentication)
Basically this phase is to setup a secure management channel for IKE phase 2
IKE phase 2
Negotiate and exchange IPSec Parameter protecting by existing existing IKE SA
Periodically renegotiate IPsec SAs to ensure security
Data transfer also happen in this stage
Example : Step by step how to configure a secure IPsec
1. Setup ISAKMP policy (IKE Phase 1), the management phase
png(config)#crypto isakmp policy 50 // give policy number, the lower the higher priority
png(config-isakmp)#authentication pre-share // pre-share, both site much share the same key
png(config-isakmp)#encryption des
png(config-isakmp)#group 2 // select group for DH key to use
png(config-isakmp)#hash sha
png(config)#crypto isakmp key cisco123 add 71.209.254.34 // define the pre-share key here,
set address for the peer
2. Setup IPsec transform set (IKE Phase 2), basically this is where we define the set of
encryption and hash for the data to use
png(config)#crypto ipsec transform-set CISCO_SET esp-des esp-sha-hmac
3. Define interesting traffic using access-list command, here is where where we define
which subnet or address that need to be forwarded to the IPsec channel
png(config)#ip access-list extended INT_TRAFFIC
png(config-ext-nacl)#permit ip 172.3.0.0 0.0.255.255 192.168.1.0 0.0.255.255
!interface FastEthernet0/1
no ip address
shutdown
duplex auto
speed auto
!
router eigrp 60
network 192.168.0.0 0.0.255.255
auto-summary
no eigrp log-neighbor-changes
!
ip forward-protocol nd
!
!
ip http server
no ip http secure-server
!
access-list 110 permit gre host 17.1.1.1 host 17.1.2.1
access-list 120 permit gre host 17.1.1.1 host 17.1.2.2
control-plane
line con 0
line aux 0
line vty 0 4
login
end
Sample Conf for cyb
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname cyb
!
boot-start-marker
boot-end-marker
no aaa new-model
memory-size iomem 5
ip cef
ip auth-proxy max-nodata-conns 3
ip admission max-nodata-conns 3
!
crypto isakmp policy 1
authentication pre-share
crypto isakmp key cisco123 address 0.0.0.0 0.0.0.0
!
!
crypto ipsec transform-set strong esp-3des esp-md5-hmac
mode transport
!
crypto map vpn 10 ipsec-isakmp
set peer 17.1.1.1
set transform-set strong
match address 110!
interface Tunnel1
ip address 192.168.1.2 255.255.255.0
tunnel source FastEthernet0/0
tunnel destination 17.1.1.1
crypto map vpn
!
interface FastEthernet0/0
ip address 17.1.2.1 255.255.0.0
duplex auto
speed auto
crypto map vpn
!
interface FastEthernet0/1
no ip address
shutdown
duplex auto
speed auto
!
router eigrp 60
network 192.168.0.0 0.0.255.255
auto-summary
no eigrp log-neighbor-changes
!
ip forward-protocol nd
!
ip http server
no ip http secure-server
!
access-list 110 permit gre host 17.1.2.1 host 17.1.1.1
!
control-plane
!
line con 0
line aux 0
line vty 0 4
login
!
!
end
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname lab
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
memory-size iomem 5
ip cef
!
ip auth-proxy max-nodata-conns 3
ip admission max-nodata-conns 3
!
crypto isakmp policy 1
authentication pre-share
crypto isakmp key cisco123 address 0.0.0.0 0.0.0.0!
crypto ipsec transform-set strong esp-3des esp-md5-hmac
mode transport
!
crypto map vpn 20 ipsec-isakmp
set peer 17.1.1.1
set transform-set strong
match address 120
!
interface Tunnel2
ip address 192.168.2.2 255.255.255.0
tunnel source FastEthernet0/0
tunnel destination 17.1.1.1
crypto map vpn
!
interface FastEthernet0/0
ip address 17.1.2.2 255.255.0.0
duplex auto
speed auto
crypto map vpn
!
interface FastEthernet0/1
no ip address
shutdown
duplex auto
speed auto
!
router eigrp 60
network 192.168.0.0 0.0.255.255
auto-summary
no eigrp log-neighbor-changes
!
ip forward-protocol nd
!
!
ip http server
no ip http secure-server
!
access-list 120 permit gre host 17.1.2.2 host 17.1.1.1
!
control-plane
!
line con 0
line aux 0
line vty 0 4
login
!
end